Investigate PDF files - reuteras/dfirws GitHub Wiki

There are a couple of tools available in dfirws to investigate PDF files. Some of them are:

• pdf-parser.py
• pdfalyzer
• pdfid.py
• PDFStreamDumper
• peepdf-3 (virtualenv name peepdf3)
• qpdf

There is a Jupyter Notebook available to analyse PDF files.

Resources

• You can see this local pdf of the article How to Analyze Malicious PDF Files by Intezer.
• DFIR pdf analysis by neolea
• PDF Object Streams